First Flight #13: Baba Marta

Summary

Listing a token for sale does not check if this token is listed already.

Vulnerability Details

The issue happens when a buyer runs buyMartenitsa() at an initial price of X and the seller front-runs him by re running listMartenitsaForSale() at a higher price than initial price X.

Impact

The impact would be for the buyer to pay a much higher price than the price he thought he would pay.

Tools Used

Visual inspection

Recommendations

add a check that token is not already for sale like this :
require(!tokenIdToListing[tokenId].forSale);